Xero is rebuilding user permissions: a prompt to review who can see what in your practice

Xero published a post on 31 October 2026 titled "Rebuilding user permissions: what's live and what's next", by Jenny Tran of Xero. The post is the source for everything attributed to Xero below: https://blog.xero.com/product-updates/user-permissions/.

What the post says

Xero describes how access has worked until now, using a plain analogy. In its words: "Access in Xero has worked a bit like a house key. You either hand it over or you don't."

It then gives two examples of the problem. "To let someone raise a purchase order, you handed over the supplier bills with it." And: "To let someone count stock, you opened up financial data they had no reason to see."

The post presents the rebuild as Xero's response, and points readers to the Users page: "Open the Users page in Xero to see what you can set." It also says that existing users are not changed automatically: "Existing users keep the access they have today." In Xero's words, "Changes only happen when someone with the edit users permission makes them."

For practices on Partner Edition, the post says: "If your practice uses Partner Edition plans, your permissions stay exactly as they are."

This article does not summarise which roles or permissions exist in which Xero plan. The post and the Xero Central article it links to are the place to check that detail for the organisations you look after.

Who is affected

Any practice that helps clients set up Xero users, or that gives its own staff access to client organisations, has a reason to read the post. Xero itself names the practice angle: "Day to day access requests have a way of routing through the practice".

The wider point is not specific to one product. When access is all-or-nothing, the easiest way to let a person do one task is to give them far more than the task needs. The Xero post describes exactly that pattern, and the same pattern can sit in any system a practice uses, including its own practice management, document and email tools.

What to do next

This is general information, not advice about your own obligations. A few practical checks a practice might run, in plain terms:

• List who has access to what. Start with a simple list of each person with access to a client file and the task they actually do there.
• Match access to the task. Where someone only needs one task, ask whether a narrower option exists in the system before leaving a broad role in place. Check the vendor's own documentation for what your plan supports rather than assuming.
• Check who can change access. The post notes that changes happen when someone with the edit users permission makes them. Knowing who holds that permission tells you who can widen access later.
• Record the reason. A one-line note on why a person has a given level of access makes the next review faster.
• Raise it with clients. If a client is adding a new staff member or contractor, it is a natural moment to ask what that person needs to do.

A short example

Picture a small practice that has a part-time assistant who only prepares and sends purchase orders for a client. The assistant was given a broad role because it was the quickest way to get the job done. Nobody revisited it. A routine review asks one question: what does the assistant do, and does the access match? That is the same gap the Xero post describes with its purchase order example. The review might find that the access is fine, or that it is wider than the task. Either way, the practice now knows, and has a written reason.

Where to read more

Read the full Xero post, dated 31 October 2026, at https://blog.xero.com/product-updates/user-permissions/. For support in building a review habit across the practice, see the Fedix resources at https://home.fedix.ai/resources/blog. For any question about your own responsibilities, speak to a registered tax agent or your professional body.